{
 "id": "WPSEC-2026-3037",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3037/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3037/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3037/index.md",
 "title": "Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist <= 1.8.4 - Unauthenticated DOM-Based Cross-Site Scripting via Widget Iframe postMessage",
 "description": "The Bit Assist plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the chat widget iframe page ('clientDomain' parameter and the 'windowLoaded' postMessage) in all versions up to, and including, 1.8.4. This is due to the widget iframe accepting its API endpoint from any window's postMessage without checking the message origin, then inserting the returned widget data (such as the call-to-action text) into the page with innerHTML. The iframe endpoint also accepted any domain in the 'clientDomain' parameter as an allowed frame ancestor without checking that a widget was configured for it. This makes it possible for unauthenticated attackers to run arbitrary web scripts in the context of the affected site if they can trick a user into visiting a page they control, which frames or opens the widget iframe and points it at attacker-supplied widget data.",
 "plugin": {
  "slug": "bit-assist",
  "name": "Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist",
  "full_name": "Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist",
  "wordpress_org": "https://wordpress.org/plugins/bit-assist/",
  "advisories_url": "https://wpsec.com/vuln/plugin/bit-assist/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/bit-assist"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.5",
 "remediation": "Update to 1.8.5 or later.",
 "fix_released": "2026-11-12T09:11:47+00:00",
 "published": "2026-11-13T09:43:21+00:00",
 "updated": "2026-11-12T17:09:40.286993+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3037/",
  "https://plugins.svn.wordpress.org/bit-assist/tags/1.8.5/",
  "https://wordpress.org/plugins/bit-assist/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/bit-assist",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}